Founder GPShopper (successful exit) ex-Jane Street (pre-SBF) ex-Google (pre-Sundar) occasional shitpoaster
United States
Joined October 2009
- Tweets1.4K
- Following649
- Followers879
- Likes10.1K
me in Sep 2026: if you must buy IoT, pick a vendor with a strong security record to ensure your home and business are protected
me in Nov 2026: lmao buy Tuya, Xiongmai, Netgear, old D-Link the worse their security the easier it is to flash your own ROM
Replacing Git is in the news so here's a story from my time on Google's source tools team 10 years ago
The #1 question: why does Google use an awful Perforce clone for the monorepo instead of Git?
I met people across half the planet to find out. It’s not what you think!
1
3
135
It’s hard to believe now, given recent actions (looking at you, Android), but at the time Google was so idealistically committed to open source that people reacted with hostility if you even dared to suggest Google use its influence to push massive monorepo extensions into Git.
Instead, engineers on the source tools team were told to do months or years of engineering work on extensions, submit them to the Git project, and let the invisible hand of the open source community decide if they were fit to be included in Git. Only then would the Git-on-Borg team consider implementing them.
This was obviously insane, so the team just dropped it and focused on their Perforce clone. They considered Mercurial, which would have been much easier to extend thanks to Python duck typing, but it didn’t have Git’s name-brand familiarity and so was deemed not worth the churn.
Meanwhile, goddamn MICROSOFT was hard at work shipping massive monorepo Git extensions without a care in the world.
1
1
23
Meanwhile Chrome and Android, stuck on Git because they had to share code with the world, spent 15+ years struggling to hold their massive codebase together with bubblegum and tape. All so nobody had to suggest Google was throwing its weight around.
In the end, Git really doesn’t scale. When Anthropic built Scion to replace it, the prior art they cited was Google’s shitty Perforce clone, Piper.
The Git-on-Borg team was right all along, albeit accidentally.
1
29
Asked Claude to write, in Rocq, this trivial program: given a number T and a file of "name => temp" lines, print each name whose temp is above T
300+ lines!
And it turns out my spec wasn't comprehensive enough, so it still has bugs.
I dunno guys.
1
4
182
The funniest part about the Chinese spy thing is it still works even if she's obviously a Chinese spy
3
160
if the AI labs do implode it'll be because they'll discover intelligence wasn't that much of a limiting factor, because there's too much intelligence-resistant stupidity slowing everything down
3
88
Tootsie Rolls taste like something that Milo Minderbender guy in Catch 22 would make in a wax factory in Malta and try to sell to the army
1
118
Anthropic and OpenAI should be worth an extra trillion just because they mean I never have to accept a package which depends on Node ever again
82
daily Claude automated task
1. check Chrome open source project for updates
2. rebase our ad block/privacy patches
3. build and deploy to devices
a private Chrome fork for every household
1
2
114
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
5
214
This formal verification article from Anthropic in collab with @theoremlabs throws some shade on OCaml but it's been repeatedly proven that OCaml has no trusting trust backdoors.
anthropic.com/research/forma…
discuss.ocaml.org/t/ocaml-co…
1
151
insurer: cybersec claims department
me: hi yes, I'd like to put in a claim, my PHP site was hacked
ins: have you heard of claude code? do you use it?
me: yes
ins: haven't you had, like, 6 months to auto-rewrite all of your PHP in a less stupid language?
me:
1
4
176
did they nerf the models? opus 5.5 has been cranking out just barely under 10,000 lines of code an hour today
3
187
